Closed Bug 570546 Opened 11 years ago Closed 11 years ago

spidermonkey assertion failure building dehydra: !prev->isActive()


(Firefox Build System :: Source Code Analysis, defect)

Not set


(Not tracked)



(Reporter: ehren.m, Unassigned)




(2 files, 2 obsolete files)

rev a00078178698 (Bug 540706) introduces the following assertion failure running the test suite. Output:

Test Failure: 
    Test command: /home/ehren/gcc4.5/dist.4.5.0/bin/g++ -c -fplugin=../ -o /dev/null -fplugin-arg-gcc_dehydra-=test_sys_gcc_info.js
    Failure msg: Expected 'OK' output; Errors:
 Assertion failure: !prev->isActive(), at ../jscntxt.h:1715
cc1plus: internal compiler error: Aborted

Test Failure: 
    Test command: /home/ehren/gcc4.5/dist.4.5.0/bin/g++ -c -fplugin=../ -o /dev/null -fplugin-arg-gcc_dehydra-=test_strict.js
    Failure msg: Expected 'OK' output; Errors:
 Assertion failure: !prev->isActive(), at ../jscntxt.h:1715
cc1plus: internal compiler error: Aborted

Test Failure: 
    Test command: /home/ehren/gcc4.5/dist.4.5.0/bin/g++ -c -fplugin=../ -o /dev/null -fplugin-arg-gcc_dehydra-=test_require.js
    Failure msg: Expected 'OK' output; Errors:
 ./test_require.js:12: JS Warning: Unrecognized require keyword 'a'
Assertion failure: !prev->isActive(), at ../jscntxt.h:1715
cc1plus: internal compiler error: Aborted

Unit Test Suite Summary:
     41 passed
      3 failed
      0 error(s)

Stack trace:

#0  0x00000038838326d5 in raise () from /lib64/
#1  0x00007ffff1b4c608 in JS_Assert (s=0x7ffff1bde082 "!prev->isActive()", file=0x7ffff1bddf87 "../jscntxt.h", ln=1715) at ../jsutil.cpp:80
#2  0x00007ffff1a3ac05 in JSContext::assertCallStacksInSync (this=0x1a76410) at ../jscntxt.h:1715
#3  0x00007ffff1a3acd2 in JSContext::getCurrentCallStack (this=0x1a76410) at ../jscntxt.h:1736
#4  0x00007ffff1a3ae10 in js::StackSpace::assertIsCurrent (this=0x7ffff19c15b0, cx=0x1a76410) at ../jscntxtinlines.h:78
#5  0x00007ffff1a3659f in js::StackSpace::popInvokeFrame (this=0x7ffff19c15b0, cx=0x1a76410, maybecs=0x7ffff15c10f8) at ../jscntxt.cpp:319
#6  0x00007ffff1a3656c in js::InvokeFrameGuard::~InvokeFrameGuard (this=0x7fffffffd150, __in_chrg=<value optimized out>) at ../jscntxt.cpp:313
#7  0x00007ffff1aab7fa in js_Invoke (cx=0x1a76410, args=..., flags=2) at ../jsinterp.cpp:648
#8  0x00007ffff1a98483 in js_Interpret (cx=0x1a76410) at ../jsops.cpp:2162
#9  0x00007ffff1aac046 in js_Execute (cx=0x1a76410, chain=0x7ffff1202000, script=0x1a82dc0, down=0x0, flags=0, result=0x7fffffffdb10) at ../jsinterp.cpp:818
#10 0x00007ffff1a1f523 in JS_ExecuteScript (cx=0x1a76410, obj=0x7ffff1202000, script=0x1a82dc0, rval=0x7fffffffdb10) at ../jsapi.cpp:4760
#11 0x00007ffff1e6e926 in dehydra_loadScript (this=0x7ffff2080040, filename=0x1aaded0 "test_sys_gcc_info.js", namespace=0x7ffff1202000) at dehydra_builtins.c:437
#12 0x00007ffff1e6ebd2 in Include (cx=0x1a76410, obj=0x7ffff1202000, argc=1, argv=0x7fffffffdc38, rval=0x7fffffffdc30) at dehydra_builtins.c:472
#13 0x00007ffff1e71fb3 in dehydra_includeScript (this=0x7ffff2080040, script=0x1aae580 "test_sys_gcc_info.js") at dehydra.c:195
#14 0x00007ffff1e6d0a6 in gcc_plugin_init (file=0x7fffffffe2b1 "../", arg=0x1a265c0 "test_sys_gcc_info.js", pass=0x7fffffffdcd0, version_string=0x1948680 "4.5.0") at dehydra_plugin.c:280
#15 0x00007ffff1e6d45d in plugin_init (plugin_info=0x19fa430, version=0x19486a0) at dehydra_plugin.c:482
#16 0x0000000000b19a9f in try_init_one_plugin (plugin=0x19fa430) at ../../gcc-4.5.0/gcc/plugin.c:574
#17 0x0000000000b19af2 in init_one_plugin (slot=0x1a26518, info=0x0) at ../../gcc-4.5.0/gcc/plugin.c:596
#18 0x0000000001302fb0 in htab_traverse_noresize (htab=0x1a26490, callback=0xb19acb <init_one_plugin>, info=0x0) at ../../gcc-4.5.0/libiberty/hashtab.c:753
#19 0x0000000000b19b65 in initialize_plugins () at ../../gcc-4.5.0/gcc/plugin.c:621
#20 0x0000000000c13cd3 in toplev_main (argc=15, argv=0x7fffffffdef8) at ../../gcc-4.5.0/gcc/toplev.c:2517
#21 0x00000000007d0320 in main (argc=15, argv=0x7fffffffdef8) at ../../gcc-4.5.0/gcc/main.c:35
Looks like the failure is due to |require|.
I'll look into it.
Attached patch patch (obsolete) — Splinter Review
The problem line in Require is |argv[argc+1] = prop;|. dwitte thinks this a hack to ensure prop is rooted and suggested JS_EnterLocalRootScope instead.
Attachment #449753 - Flags: review?(tglek)
Attachment #449753 - Flags: review?(tglek) → review-
Comment on attachment 449753 [details] [diff] [review]

> JSBool Require(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
>                jsval *rval)
> {
>+  if (!JS_EnterLocalRootScope(cx)) return JS_FALSE;
>   JSObject *args;
>   if (!JS_ConvertArguments(cx, argc, argv, "o", &args)) return JS_FALSE;
>   JSIdArray *prop_ids = JS_Enumerate(cx, args);
>   if (!prop_ids) return JS_FALSE;

This method has a whole bunch of early returns that will screw this up.

>   /* Apply the options. */
>   JSBool retval = JS_TRUE;
>   int i;
>   for (i = 0; i < prop_ids->length; ++i) {
>     jsval prop;
>     JSBool rv = JS_IdToValue(cx, prop_ids->vector[i], &prop);
>-    argv[argc+1] = prop;
try doing *rval = prop instead. I'm not sure if argv[argc+1] is supposed to be rooted.
Attached patch patch (obsolete) — Splinter Review
moving root push/pop to for loop body
Attachment #449759 - Flags: review?(tglek)
Attachment #449753 - Attachment is obsolete: true
Comment on attachment 449759 [details] [diff] [review]

< prop_ids->length; ++i) {
>+    if (!JS_EnterLocalRootScope(cx)) return JS_FALSE;
just xassert this
Attachment #449759 - Flags: review?(tglek) → review+
Attached patch patchSplinter Review
Attachment #449759 - Attachment is obsolete: true
Closed: 11 years ago
Resolution: --- → FIXED
Product: Core → Firefox Build System
You need to log in before you can comment on or make changes to this bug.